Subscribe To Our Newsletter
Subscribe To Our Newsletter
Western Montana Clinic has agreed to a class action settlement resolving claims stemming from a 2025 email data breach that compromised the medical and personal files of approximately 9,506 patients.
A court has preliminarily approved a class action settlement with Western Montana Clinic over a 2025 email data breach that exposed the private health and personal information of thousands of patients. If you received an official notice of this breach, you may be eligible to claim up to $5,000 in cash benefits and medical monitoring.
The class action settlement resolves allegations that Western Montana Clinic (WMC), a primary care provider based in Missoula, Montana, failed to adequately safeguard patients’ private information. The legal dispute traces back to a security incident that occurred between March 11, 2025, and April 15, 2025. During this month-long period, an unauthorized third party managed to gain access to a specific employee email account within the clinic’s network.
Following an internal investigation to evaluate the scope of the incident, WMC determined that the compromised email account contained highly sensitive patient databases. While the clinic worked to secure its systems, the vulnerability had already allowed outside access to the personal records of thousands of patients. In August 2025, the healthcare provider began mailing out written notification letters to notify affected individuals that their private information may have been compromised. According to court records, approximately 9,506 people were mailed a notification, warning them that their most personal data was in jeopardy.
In any major medical data breach, the specific type of information exposed dictates the level of risk the affected individuals face moving forward. For patients of Western Montana Clinic, the exposed data contained a deeply personal mix of contact details, demographic facts, and sensitive medical history.
According to the lawsuit, the categories of compromised information included:
Full names and contact details
Social Security numbers
Dates of birth
Internal medical identification numbers
Specific dates of medical service
Names of treating physicians
Prescribed medication information
Individual treatment or diagnostic details
When cybercriminals obtain medical records and Social Security numbers, the long-term threat to consumers is severe. Unlike a credit card that can be easily canceled and replaced, your medical history, date of birth, and Social Security number stay with you for life. Cybercriminals can use this data to commit medical identity theft, open fraudulent financial accounts, or file false insurance claims. Because of these long-term threats, affected consumers often face years of anxiety and financial monitoring.
Class action lawsuits are one of the most powerful tools available for everyday people to hold large corporations accountable. When a business or medical facility fails to implement reasonable cybersecurity measures, individual consumers rarely have the time, money, or resources to sue a major corporation on their own. By banding together in a class action, affected individuals can level the playing field.
Western Montana Clinic denies all allegations of negligence and maintains that it did not violate any laws. The clinic has not admitted to any wrongdoing or liability. However, to avoid the staggering costs, distractions, and uncertainty of ongoing litigation, the clinic agreed to the terms of this class action settlement.
This settlement provides a structured pathway for affected individuals to secure cash compensation for their losses and obtain professional identity protection services. It ensures that those who suffered financial harm or spent hours protecting their credit do not have to carry that burden alone.
If you are a class member and you file a timely, valid claim form, you can choose from several forms of relief. The settlement is designed to offer flexibility depending on how the data breach impacted your life, whether you lost hard earned money or simply spent time monitoring your accounts.
First, class members can claim up to $5,000 for documented out-of-pocket losses incurred due to the data breach. This includes expenses like fraudulent charges, bank fees, credit monitoring costs, or communication fees. To receive this payment, you must submit proof of these expenses, such as receipts or bank statements.
Second, you can submit a claim to receive cash compensation for up to three hours of lost time spent responding to the data breach. This time is compensated at a rate of $20 per hour, for a maximum payment of up to $60. No documentation is required to claim lost time, though you must describe the actions you took. Finally, all class members can file a claim to enroll in one free year of CyEx Medical Shield Pro, which includes specialized medical data monitoring.
The lawsuit brought against Western Montana Clinic argued that the provider had a legal duty to protect patient information under both state and federal guidelines. Under federal law, the Health Insurance Portability and Accountability Act (HIPAA) sets the baseline standard for protecting sensitive patient data. HIPAA requires healthcare organizations to maintain rigorous administrative, physical, and technical safeguards to keep protected health information secure.
While HIPAA does not give individual patients the direct right to file a lawsuit on their own, state-level consumer protection acts and common-law negligence claims allow consumers to seek justice when a business fails to protect their data.
The plaintiffs in the WMC case argued that the clinic failed to live up to these basic industry standards by keeping patient details in employee email accounts that were vulnerable to unauthorized access. By securing a settlement, the legal system helps establish a precedent that healthcare facilities must treat cybersecurity as a vital component of patient care.
You may be eligible to participate in this settlement if you received an official notice from Western Montana Clinic stating that your personal health information was potentially impacted by the 2025 email data breach. The settlement class covers everyone who was sent a direct notification regarding the incident.
Because the clinic mailed notifications to approximately 9,506 people, checking your mail records from late summer or autumn of 2025 is the best way to verify your status. Most eligible class members should have received a settlement notice package containing a unique Notice ID and a Confirmation Code. You will need these specific credentials to complete your claim form online.
If you believe your information was compromised but you never received a notice, or if you lost your physical paperwork, you can contact the settlement administrator through the official portal to check your eligibility status.
To receive any of the benefits offered under the settlement, you must actively file a valid claim form. The court-approved website is now fully operational at WMCSettlement.com. Through this portal, class members can securely submit their forms and upload any required documentation.
If you prefer to submit your claim manually, you can download a PDF version of the claim form from the site, print it out, and mail it to the settlement administrator. Whether you choose to file online or by mail, you must meet the court’s strict deadline to receive your share of the settlement benefits.
The Western Montana Clinic settlement received preliminary approval from the court on May 18, 2026. This means the court has reviewed the initial deal and found it fair enough to present to the public. However, the litigation is not yet entirely resolved.
The court has scheduled a final approval hearing for Sept. 9, 2026. At this hearing, the presiding judge will evaluate any objections submitted by class members, review the final terms of the deal, and decide whether to officially finalize the settlement.
If the court grants final approval, payments and medical monitoring codes will begin to be distributed to class members. Keep in mind that this process can take time. If any appeals are filed by third parties, they must be resolved before any cash is sent out. This means it may be several months after the final hearing before payouts reach your mailbox.
New cases and investigations, settlement deadlines, and news straight to your inbox.
